SSO Provider Credential Cache (logged out of Google/GitHub, could still log into Courier)

Summary

After researching this further, our authentication provider (Amazon's AWS Cognito) caches the access token provided by Google, GitHub, and other SSO providers within their system for up to an hour and does not check against the SSO provider's API again until that cache has expired. We did verify that after one hour, you cannot log in if the token has been removed from the SSO provider side.

Courier is unable to make any requests to the SSO provider API immediately after access is revoked. Users' SSO provider accounts remain 100% secure and after that cache period of up to 1 hour, any user attempting to sign in with SSO will be required to reauthorize Courier's OAuth application before logging in successfully again.

We would love to change this behavior – thank you for the report – but this is currently a limitation of Amazon's AWS Cognito.